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In the Claims: 

1. (Currently Amended) A method of identifying problems in applications, 
comprising: 

monitoring at a kernel level system resource usage of one or more running processes 
belonging to one or more user applications without modifying run-time environments of the 
running one or more user applications; and 

from the monitored system usage, identifying to a user from the monitored system 
usage, aft a first user application whose system usage pattern satisfies a predetermined criteria 
associated with one or more problems. 

2. (Currently Amended) The method of claim 1, wherein the system resource 
usage comprises a number of the one or more processes that each of the one or mor e running 
user applications have spawned and the predetermined criteria comprises a predetermined 
limit on the number of processes that each of the one or more user applications may spawn. 

3. (Currently Amended) The method of claim 1, wherein monitoring at a 
kernel level system resource usage of one or more running processes comprises monitoring a 
parent-child relationship between each of the one or more processes and each of the one or 
more user applications; and 

identifying to a user a first user application whose system usage pattern satisfies a 
predetermined criteria associated with one or more problems comprises identifying a first 
user application that has orphaned one of the one or more running processes, the systom 
resource usage comprises central processing unit usage of th e ono or more runnin g 
applications. 

4. (Currently Amended) The method of claim 1, wherein the system resource 
usage comprises memory usage of the one or more running processes, applications. 

5. (Currently Amended) The method of claim 1 , wherein the one or more user 
applications comprise one or more applications initiated at the user level and the one or more 
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running processes comprise one or more processes initiated at the kernel level by the one or 
more user applications. 

further comprioing: producing an output comprising at least the system resource usage 
associated with each of tho ono or more running applications. 

6. (Currently Amended) The method of claim i & wherein the system resource 
usage of the one or more running processes is monitored over a plurality of consecutive 
discrete time periods. 

the identifying comprises: 

identifying from th e output an application whose system resource usag e pattem 
satisfies a predetermined criteria associated with one or more problems. 

7. (Currently Amended) The method of claim 6, whereim 

the system resource usage comprises an amount of memory usage for each of the one 
or more processes; and 

the predetermined criteria is a limit on a number of memory increases allowed during 
the pluraUty of time periods, an increas e in amount of the system r e source usage firom a first 
period to a second period. 

8. (Currently Amended) The method of claim 6, wherein: 

the system resource usage comprises an amount of memory usage for each of the one 
or more processes; and 

the predetermined criteria is a generally continuous increase in the amount of memory 
usage during the plurality of time periods. 

wherein the predetermined criteria is a continuous increas e in amount of tho system 
resource usage from a first period to a second period . 

9. (Currently Amended) The method of claim 6 4-, whereim 

the system resource usage comprises a number of the one or more processes that each 
of the one or more user applications have spawned; and 

the predetermined criteria is a generally continuous increase in the number of child 
processes spawned during the plurality of time periods. 
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the monitoring comprises: 

using an available kemel level tool to obtain data associated with the system resource 

usage. 

10. (Currently Amended) The method of claim 1, wherein identifying to a user a 
first user application whose system usage pattern satisfies a predetermined criteria associated 
with one or more problems comprises saving an identifier of the first application in a 

reference file, and further comprising saving identifiers of any other of the one or more user 
apphcations whose system usage pattern satisfies a predetermined criteria associated with one 
or more problems in the reference file. 

wherein th e monitoring comprises: 

using an available kemel level tool to obtain data that includes the system resource 
usage; and 

filtering the data to obtain a select e d system resource usage. 

11. (Currently Amended) The method of claim 10, wherein a computer 
automatically monitors the kemel level system resource usage of one or more running 
processes and identifies the first user application. 

identifying comprises at least: 

using the filtered data to identify an application w^hose system resource usage pattern 
satisfies a predetermined criteria associated wdth one or more problems. 
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12. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of a one or more running processes 
belonging to a user application applications without modifying run-time environment 
environments of the user application running applications ; and 

producing an output comprising at least the memory usage; and 

from the monitored memory usage, identifying to a user from the monitored memory 
usage, aft a first user application whose system memory usage pattern satisfies a 
predetermined criteria associated with one or more problems. 

13, (Currently Amended) The method of claim 12, wherein: 

the memory usage of the one or more running processes is monitored over a plurality 
of consecutive discrete time periods, and 

the predetermined criteria is a limit on a number of memory increases allowed during 
the plurality of time periods. 

further comprising: 

analyzing the output to identify a memory problem. 
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14. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of one or more running processes 
belonging to one or more user applications without modifying run-time environments of the 
running one or more user applications; 

respectively liking each of the one or more running processes to each of the one or 
more user applications; 

producing an output comprising at least the memory usage of one or more running 
user applications: and 

identifying from the output, identifying ^ a first user application whose memory 
usage pattern satisfies a predetermined criteria associated with one or more memory 
problems. 
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15. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of one or more running processes 
belonging to one or more running user applications without modifying run-time environments 
of the running user applications; and 

from the monitored memory usage , identifying from the monitored memory usage, an 
a first running user application whose memory usage pattern satisfies a predetermined criteria 
associated with one or more memory problems. 

16. (Original) The method of claim 15, wherein the monitored memory usage 
comprises at least a stack memory, data memory, and text memory. 
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17. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

collecting system resource usage at a kemel level of one or more running processes 
belonging to one or more user applications without modifying run-time environments of the 
one or more user running applications; and 

from the collected system resource usage, identifying from the collected system 
resource usage, an a first user application whose system resource usage pattem satisfies a 
predetermined criteria associated with one or more system resource usage problems. 
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18. (Currently Amended) A system for identifying problems in applications, 
comprising: 

a data collection module operable to retrieve information about a running user 
applications application at a kernel level; and 

a data analysis module operable to determine from the retrieved information an 
abnormal system usage pattern in the information; and identify from the abnormal system 
usage pattern, an a first user application whose system usage pattern satisfies a predetermined 
criteria associated with one or more problems. 
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19. (Currently Amended) A program storage device readable by machine, 
tangibly embodying a program of instructions executable by the machine to perform method 
steps of identifying problems in applications, comprising: 

monitoring at a kemel level system resource usage of one or more running processes 
belonging to one or more user applications without modifying run-time environments of the 
ruiming one or more user applications; and 

from the monitored system usage, identifying to a user from the monitored system 
usage, a n a first user application whose system usage pattem satisfies a predetermined criteria 
associated with one or more problems. 

20, (Currently Amended) The program storage device of claim 19, wherein the 
system resource usage comprises a parent-child relationship between each of the one or more 
processes and each of the one or more user applications: and 

identifying to a user a first user application whose system usage pattern satisfies a 
predetermined criteria associated with one or more problems comprises identifying a first 
user application that has orphaned a process. 

the syst e m resource usage is memory usage, CPU usage, or one or mor e spawned 
process e s, or combinations thereof. 
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